Ciphertext-Only Cryptanalysis of Hagelin M-209 Pins and Lugs George Lasry Nils Kopal Mishmar Hayarden 5 University of Kassel Givataim, 5358205 Israel Pfannkuchstr. 1
[email protected] 34121 Kassel, Germany
[email protected] Arno Wacker University of Kassel Pfannkuchstr. 1 34121 Kassel, Germany
[email protected] Abstract The Hagelin M-209 was a mechanical encryption device used by the US Army during World War 2 and the Korean War, as well as by other armies and in embassy settings. In this paper, we present a 4-stage hillclimbing algorithm for recovering the full key settings from ciphertext only. The two first stages are based on a divide-and-conquer approach developed by Geoff Sullivan. In our performance evaluation, we show that our method is able to recover key settings from messages as short as 750 letters, compared to 2 000 − 2 500 letters with prior methods. With this method, we solved several M-209 ciphertext-only challenges, including the final exercises in W. Barker's 1977 book, Cryptanalysis of the Hagelin Cryptograph. Keywords: Hagelin, M-209, Hillclimbing, Ciphertext-Only Attack, Cryptanalysis, Crypto- graphic Challenge, NSA 1 Introduction The trigger for our research was an intriguing story published by Dennis Ritchie in 2000 [19]. The story also appeared in Cyberpunk, Outlaws and Hackers on The Computer Frontier by Katie Hafner and John Markoff in 1991 [9]. Dennis Ritchie (1941-2011) is best known as the inventor of the UNIX operating system (together with Ken Thomson), and of the C programming language. According to his account, in the late 1970s, James Reeds, Robert Morris and Dennis Ritchie developed a ciphertext- only method for recovering keys from Hagelin M-209 messages.